The US military mistakenly sent live anthrax bacteria to laboratories in nine US states and a US air base in South Korea, after apparently failing to properly inactivate the bacteria last year, US officials said on Wednesday.

The Pentagon said there was no known suspected infection or risk to the public. But four US civilians have been started on preventive measures called post-exposure prophylaxis, which usually includes the anthrax vaccine, antibiotics or both.

Twenty-two personnel at the base in South Korea were also given precautionary medical measures although none have shown sign of exposure, the US military said.

The four in the United States face “minimal” risk, said Jason McDonald, a spokesman for the US Centers for Disease Control and Prevention (CDC), which has begun an investigation of the incident. They had been “doing procedures that sent the agent into the air,” he said.

When anthrax becomes airborne, it can cause a deadly illness called inhalation anthrax. That occurred in 2001, when anthrax sent through the US mail to government and media targets killed five people.

The anthrax, which was initially sent from a Utah military lab, was meant to be shipped in an inactive state as part of efforts to develop a field-based test to identify biological threats, the Pentagon said.

“Out of an abundance of caution, (the Defense Department) has stopped the shipment of this material from its labs pending completion of the investigation,” said Pentagon spokesman Colonel Steve Warren.

The CDC said it has launched an investigation of the mishap.

All samples involved in the investigation will be securely transferred to the CDC or affiliated labs for further testing, spokeswoman Kathy Harden said, adding that CDC has sent officials to the labs “to conduct on-site investigations.”

The mishap comes 11 months after the CDC, one of the government’s top civilian labs, similarly mishandled anthrax.

Researchers at a lab designed to handle extremely dangerous pathogens sent what they believed were killed samples of anthrax to another CDC lab, one with fewer safeguards and therefore not authorized to work with live anthrax.

Scores of CDC employees could have been exposed to the live anthrax, but none became ill.

That incident and a similar one last spring, in which CDC scientists shipped what they thought was a benign form of bird flu but which was actually a highly virulent strain, led US lawmakers to fault a “dangerous pattern” of safety lapses at government labs.

Anthrax sent to government and private facilities

In the latest case, the Army’s Dugway Proving Ground in Utah reported in March 2014 that gamma irradiation had inactivated the anthrax stock in question, and along with another Army facility, began shipments that continued through April 2015, a US official said.

The official, who spoke on condition of anonymity, said the suspected live anthrax samples were sent to US federal, private and academic facilities.

The anthrax was sent to laboratories in Maryland, Texas, Wisconsin, Delaware, New Jersey, Tennessee, New York, California and Virginia, officials said.

The Maryland laboratory alerted the CDC late on Friday that it had a live sample and by midday on Saturday, the laboratories were notified, the US official said.

The four civilians receiving post-exposure prophylaxis are in Delaware, Texas and Wisconsin. “Workers who were not in the same area at the same time are not at risk,” the CDC’s McDonald said.

The sample sent to South Korea was subsequently destroyed, the Pentagon and the US military there said.

A US emergency team responded to destroy the sample on Wednesday at the US base after what was expected to be an inactive training sample was thought to be live bacteria, the US military in South Korea said.

Precautionary medical measures were given to 22 personnel who may have been exposed during the training at the base about 35 km (20 miles) south of Seoul and none of them have shown any sign of exposure, it said.

Experts in biosafety were astonished by the lapse.

“These events shouldn’t happen,” said Stephen Morse of Columbia University, a former program manager for biodefense at the Pentagon’s Defense Advanced Research Projects Agency.

Scientists working with the most dangerous pathogens follow a “two-person rule,” never handling samples alone. The second pair of eyes is meant to insure scientists take proper precautions during experiments.

Two people should also vet shipments of supposedly killed anthrax. “We can put greater safeguards in place,” Morse said.